1. Technical Field of the Invention
This invention relates generally to the field of automated system and anomaly detection and, in particular, to methods of generating system monitoring knowledge bases from nominal system behavior, and to the use of these knowledge bases in monitoring system performance in real-time or near-real time.
2. Description of Related Art
The modern information age provides great quantities of raw data concerning the performance of man-made engineered systems as well as data concerning the behavior of natural systems. Numerous information processing techniques have been employed to attempt to classify such data, look for anomalies, or otherwise assist humans to extract, understand and/or respond to information contained in the data. Examples of such techniques include model based reasoning, machine learning, neural networks, data mining, support vector machines, and various decision tree models including ID3 decision tree learner, among many others. However, these techniques typically have one or more drawbacks that render them unsuitable or disfavored for some applications.
For example, model based reasoning and related techniques typically require a detailed engineering simulation of the system under study, often including expert knowledge of system behavior, detailed behavior of system components and subsystems, and detailed knowledge of interactions among system components and failure mechanisms, among other things. Such knowledge may not be available for all components and subsystems. Furthermore, even when a reasonably accurate system simulation is available, it often requires impractical amounts of computer resources. That is, the simulation may execute too slowly to provide information in real-time or near-real time so as to be unsuitable for many practical system monitoring applications. In addition, the computer resources may not be available in space-limited or weight-limited environments such as space vehicles. Thus, a need exists in the art for computationally rapid techniques to monitor the performance of a system and detect anomalous behavior without the need for excessive computer resources.
Some classification or decision models require that the system be trained with data that include data derived from both normally-functioning systems (nominal data) as well as data derived from anomalous system behavior (off-nominal data). In many practical applications, off-nominal data are unavailable for training, and even the nominal data available for training may not fully explore all of the system's nominal operating regimes. Thus, a further need exists in the art for techniques to monitor a system's performance that does not require off-nominal data for training.
U.S. Pat. No. 7,383,238, which issued on Jun. 3, 2008, and has a common inventor and assignee as this invention, discloses an attempt to overcome some of the shortcomings identified above. In particular, the '238 patent discloses a learning algorithm that automatically extracts system models from archived system data. The '238 patent further discloses using the system models to find outlier data points. However, despite its improvement over the prior art, the techniques disclosed in the '238 patent are still lacking due to the fact that they only utilize the single best matching data point to determine an outlier. The use of a single best matching data point may be problematic where the single best matching data point is itself an outlier. It would be a significant improvement over the teachings of the '238 patent to utilize multiple data samples in a model rather than just the single best matching data point to reduce the possibility that an off nominal data point will go undetected because of a similar off nominal data point in the training data. The '238 patent is hereby incorporated by reference in its entirety as if fully set forth herein.
The features and advantages of the present disclosure will be set forth in the description that follows, and in part will be apparent from the description, or may be learned by the practice of the present disclosure without undue experimentation. The features and advantages of the present disclosure may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims.